bettercap is a Go-based, extensible framework that consolidates WiFi, BLE, HID, CAN-bus and Ethernet reconnaissance plus MITM tooling into one console for authorized red team and research work.

bettercap describes itself as the Swiss Army knife for 802.11, BLE, HID, CAN-bus, IPv4 and IPv6 networks, and the label is earned through sheer breadth rather than marketing. Written in Go, it packages reconnaissance and attack primitives for wireless and wired domains into a single portable binary, targeting security researchers, red teamers and reverse engineers who would otherwise juggle half a dozen disjoint utilities. With roughly 19,900 stars on GitHub, an active contributor base, CI pipelines for Linux, macOS and Windows, and an official Docker image at bettercap/bettercap on Docker Hub, it is one of the most mature projects in the offensive networking space. It is released under GPL 3, with a documented REST API and a companion web UI that turns it from a CLI toy into an orchestratable assessment platform.

Architecturally, the project's most interesting decision is its module system. Rather than a monolithic tool with hardcoded modes, bettercap exposes discrete modules for each capability — WiFi scanning, BLE enumeration, CAN-bus handling, spoofers, proxies, sniffers — which can be started, stopped and reconfigured at runtime from an interactive session. This design means an operator can run, say, an ARP spoofer and an HTTP proxy as concurrent modules while a discovery module passively builds the host inventory in the background. The README's emphasis on being 'easily extensible' is backed by the javascript plugin system attached to the proxies, letting analysts write custom logic for packet-level, TCP-level and application-level traffic without forking the codebase. For a professional, that extensibility is what elevates bettercap above one-shot scripts: the framework becomes a programmable substrate for network assessment.

On the wireless side, the feature list covers the full 802.11 assessment lifecycle the README enumerates: network scanning, deauthentication attack capability, the clientless PMKID association attack, and automatic WPA/WPA2/WPA3 client handshake capture. The README links out to detailed writeups on the author's site for the mass-deauther hardware build and the PMKID technique, signaling that the tool's authors treat documentation as part of the product. For defenders, the inclusion of WPA3 handshake capture is worth noting because it reflects how quickly the project tracks evolving standards. In an authorized engagement context, these modules are used to audit whether a client's wireless infrastructure withstands the exact attacks that dominate WiFi security literature, and whether monitoring detects them.

The Bluetooth Low Energy module provides scanning, characteristics enumeration, and read/write operations on GATT attributes, which positions bettercap as an IoT and embedded device assessment tool as much as a network one. Paired with the 2.4 GHz wireless scanning and MouseJacking capability — over-the-air HID frame injection with DuckyScript support — the tool reaches into the peripheral layer that many assessment methodologies forget. The CAN-bus and DBC support for decoding, injecting and fuzzing frames extends the same philosophy into automotive and industrial contexts. That is an unusually wide attack surface coverage for a single binary, and it explains why the project is a staple in hardware hacking courses and vehicle security research.

For IP networks, bettercap implements the classic MITM toolkit: ARP, DNS, NDP and DHCPv6 spoofers covering both IPv4 and IPv6, feeding traffic into its proxy chain. The proxies operate at three levels — packet, TCP stream, and HTTP/HTTPS application layer — and are fully scriptable, which is where credential auditing and traffic analysis actually happen. A fast port scanner and passive/active host probing round out the reconnaissance layer, so an operator can move from discovery to interception to inspection inside one session. The network sniffer doubles as a protocol fuzzer, according to the README, giving researchers a way to poke at custom protocols they encounter during embedded device work.

What makes bettercap genuinely operational rather than merely feature-rich is the orchestration surface. The REST API supports asynchronous event notification over websocket, meaning external tooling can subscribe to module events — a new SSID discovered, a new host fingerprinted, a handshake captured — and drive bettercap programmatically as part of a larger assessment pipeline. The web UI sits on top of that API and provides a live events view, which is also an excellent teaching aid: instructors in lab environments can project the event stream while demonstrating why spoofing detection matters. This API-first architecture is what distinguishes modern tooling from the ettercap-era scripts it effectively superseded.

From a defensive research standpoint, bettercap is equally valuable run against your own infrastructure. Standing up a lab with a spare access point and a couple of clients lets blue teams observe exactly what rogue-AP activity, spoofed ARP entries and deauthentication bursts look like in their own telemetry. Wireless intrusion detection systems can be validated against the tool's WiFi modules, and NDP/DHCPv6 spoofing detection logic can be tuned with real attacker traffic shapes rather than synthetic assumptions. Because the tool is the de facto standard in this niche, detection engineering against bettercap behavior covers a large fraction of real-world adversary tooling in the same class.

Installation is straightforward and documented through the releases page, the Docker image, and standard package availability — the typical pattern being fetching the latest release binary for your platform or pulling bettercap/bettercap from Docker Hub. For those building from source, go install github.com/bettercap/bettercap@latest against a configured Go toolchain is the canonical route. Given the sensitivity of its capabilities, professionals should keep deployments inside lab or engagement scope, run it on dedicated hardware with monitor-mode-capable wireless interfaces, and never point the spoofing or injection modules at networks lacking explicit written authorization.

Caveats worth flagging: GitHub reports the license as NOASSERTION because the license text lives in a nonstandard LICENSE.md path, though the README states plainly that the project is released under GPL 3 — commercial tooling wrapping bettercap should review the copyleft implications with counsel. The project also maintains an active Discord community for support, which matters for a tool whose wireless features depend heavily on driver and chipset quirks across platforms. Windows and macOS builds exist and are CI-tested, but the richest 802.11 functionality still generally lives on Linux with supported monitor-mode cards.

Taken together, bettercap remains the reference implementation for multi-protocol network MITM and reconnaissance tooling. Its combination of a clean module architecture, javascript-scriptable proxies, a websocket-driven REST API, and coverage from CAN-bus to WPA3 is unmatched in a single open-source project. For authorized assessors it compresses an entire toolkit into one workflow; for defenders it is the best available sparring partner for validating detection coverage. That dual utility is exactly why it has earned its place in nearly twenty thousand stars and in the standard curriculum of wireless and network security training worldwide.

Educational analysis for authorized security professionals. Use only in controlled, authorized environments.